VPC and security groups

Configure network placement with LambdaApiConfig and use LambdaApi to generate the functions.

Defaults for all functions

The default is no VPC, no subnet selection, and no security groups. Set a VPC and optionally a CDK SubnetSelection in the config to affect every generated function:

from aws_cdk import aws_ec2 as ec2
from lambda_api_decorators_cdk import LambdaApi, LambdaApiConfig

config = LambdaApiConfig(
    vpc=application_vpc,
    vpc_subnets=ec2.SubnetSelection(subnet_group_name="Application"),
    security_groups=[shared_security_group],
)

api = LambdaApi(self, "Api", lambda_path="lambdas", config=config)

If vpc_subnets is omitted, the (vpc, None) pair is passed to the CDK PythonFunction, which applies its own subnet-selection behavior. The library does not invent a subnet list. add_common_security_group adds another group for every function; identical group objects are not added twice by that mutator.

Named VPCs and handler-specific groups

Register a VPC/subnet pair and security groups by name, then select them on a handler:

from lambda_api_decorators import GET, security_group, vpc

config.register_vpc(
    "isolated",
    isolated_vpc,
    ec2.SubnetSelection(subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS),
)
config.register_security_group("orders", orders_security_group)

@GET("/orders")
@vpc("isolated")
@security_group("orders")
def orders(event, context):
    return {"statusCode": 200, "body": "ok"}

@vpc(key) replaces the configured default VPC and subnet-selection pair for that handler. @security_group appends its registered groups after the common groups. Multiple group names can be passed to the decorator, and are resolved from the custom security-group registry.

The decorator accepts names, not resource objects. The public signatures accept CDK VPC, subnet-selection, and security-group interfaces through LambdaApiConfig; the values are forwarded to PythonFunction. This guide does not claim support for imported resources or other CDK resource types beyond what those current signatures and tests establish.

Combining the settings

For a handler with a common VPC, common group shared, named VPC isolated, and named group orders, the effective values are:

VPC:              isolated
subnet selection: the selection registered with isolated
security groups:  [shared, orders]

Without @vpc, the global (vpc, vpc_subnets) pair remains. Without @security_group, only the common groups remain. A VPC can therefore be selected independently of the security-group list, while the groups are combined rather than replacing common groups.

The generated function always receives allow_public_subnet=False. The library does not expose a decorator or config option to change that value.

Verified restrictions and errors

The checked implementation establishes that a missing VPC alias or security group alias raises KeyError. The VPC alias stores the VPC and subnet selection as one pair, so selecting it cannot accidentally retain the default subnets. The config mutators replace an existing custom alias; common layers and groups are appended only once when the same object is added through the corresponding common mutator.

CDK remains responsible for validating the actual resource objects and subnet selection supplied to PythonFunction. No additional restrictions are documented here where the library has no explicit check or test.

For advanced integrations, ResourceBuilder offers the lower-level configuration surface. New applications should prefer LambdaApi and LambdaApiConfig.